[AccessToken] hardened ClientCredentialsProvider::fetchToken()

symfony · pounard · Feb 20, 2024 · Feb 20, 2024 · Feb 20, 2024 · Feb 20, 2024
commit 4eea5a93a0c7f261402b1ce96f2a37da9eada177
diff --git a/src/Symfony/Component/AccessToken/Bridge/OAuth/ClientCredentialsProvider.php b/src/Symfony/Component/AccessToken/Bridge/OAuth/ClientCredentialsProvider.php
@@ -51,7 +51,9 @@ public function supports(CredentialsInterface $credentials): bool

    protected function fetchToken(CredentialsInterface $credentials): AccessTokenInterface
    {
-        \assert($credentials instanceof ClientCredentials);
+        if (!$credentials instanceof ClientCredentials) {
+            throw new ProviderFetchException(sprintf('"%s" provider expects "%s" credentials instances.', self::class, ClientCredentials::class));
+        }

        if (!$endpointUrl = ($credentials->getEndpoint() ?? $this->getDefaultEndpointUrl($credentials))) {
            throw new ProviderFetchException('OAuth2 credentials are missing the endpoint URL.');

diff --git a/src/Symfony/Component/AccessToken/Tests/Unit/Bridge/OAuth/ClientCredentialsProviderTest.php b/src/Symfony/Component/AccessToken/Tests/Unit/Bridge/OAuth/ClientCredentialsProviderTest.php
@@ -91,4 +91,14 @@ public function testRaiseErrorWhenNoToken(): void
        self::expectExceptionMessageMatches('/OAuth2 token is missing from response/');
        $instance->getAccessToken((new OAuthFactory())->createCredentials(Dsn::fromString($dsn)));
    }
+
+    public function testRaiseErrorWhenNotClientCredentials(): void
+    {
+        $httpClient = new MockHttpClient();
+        $instance = new ClientCredentialsProvider($httpClient);
+
+        self::expectException(ProviderFetchException::class);
+        self::expectExceptionMessageMatches('/provider expects .* credentials instances/');
+        $instance->getAccessToken(new BasicAuthCredentials($username));
+    }
 }